A cluster of October security disclosures points to a sharper contest between AI-assisted vulnerability research and the teams responsible for protecting widely used software. The strongest evidence is not that the internet has suddenly become defenseless. It is that old weaknesses can become practical targets faster, while fixing them still requires coordinated engineering, careful disclosure and deployment across a fragmented web.
The clearest example is PHP2Shell, the name Wiz gave to a group of critical PHP vulnerabilities. On October 21, the PHP project released fixes for two CVEs that can permit unauthenticated remote code execution under particular conditions. Research from Wiz and OpenAI describes AI helping researchers turn difficult memory-safety flaws into working demonstrations. The PHP Foundation’s own account adds an essential qualification: people had identified signs of one underlying problem in 2024, but compatibility concerns and limited resources delayed a comprehensive fix. [1–3]
What changed in PHP
The two identifiers are CVE-2026-109618 and CVE-2026-109619. According to the PHP Foundation, they involve out-of-memory corruption and stale internal state after fatal errors. In plain language, a request can leave behind invalid memory-related state that another request later encounters. Depending on the environment and application paths, the consequences can include memory disclosure or code execution. [1,2]
Wiz demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla deployments. Those examples do not mean the fault was in those applications: the research locates the weaknesses in PHP itself. Nor do they prove every PHP installation is equally exploitable. Versions, configuration and execution paths matter. Claims about PHP’s large share of the web should not be mistaken for a measured count of compromised websites. [2]
The Foundation lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the security releases issued on October 21. Operators should follow PHP’s official guidance and their distribution or hosting provider’s instructions, including guidance for backported fixes, rather than assuming an application update alone resolves an engine-level vulnerability. [1,4]
AI discovery is only part of the story
Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol in the research. OpenAI says Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported the vulnerabilities. These are attributed accounts from participants, not independent model-performance benchmarks. [2,3]
The more consequential operational story is the repair effort. The PHP Foundation says a potential exploit path was considered in 2024 without a concrete remote-code-execution vector. Later reports made the impact clear, and fixing the issue became a top priority in August 2026. Engineers still had to balance security, performance, backward compatibility and third-party extensions. More bug-finding capacity did not eliminate those trade-offs. [1]
Disclosure also proved difficult. The Foundation says circulating CVE identifiers and later leaks disrupted the schedule, prompting it to move the release from October 22 to October 21. OpenAI describes a broader coordination effort among maintainers, researchers and infrastructure providers to prepare protections before disclosure. Together, the accounts show why the interval between discovery and widespread patching is a critical part of defense. [1,3]
The attack side: distinguish evidence from inference
A separate Railway incident illustrates why AI credentials have become valuable targets. In its October 22 preliminary report, Railway said attackers gained unauthorized access to a subset of internal systems and exposed customer secrets, with some decrypted. Its early investigation suggested the campaign sought AI-provider API keys for distillation attacks. Railway’s statements about attackers’ model access and compute resources remain preliminary assessments, not settled forensic conclusions. [5]
Railway recommended that customers who signed up before October 21 rotate keys stored on the platform. It also said existing customer deployments remained online even as builds and other services were interrupted. That distinction matters: a security incident, a precautionary shutdown and an outage of all hosted applications are not interchangeable descriptions. [5]
CrowdStrike separately reported a campaign targeting South Korean financial organizations, supported by analysis of attacker-controlled directories containing agentic-tool configuration and session histories. Its report describes ARTEX and language-model use alongside conventional offensive techniques. It did not attribute the activity to a named adversary, and the number of affected organizations was unconfirmed. This supports a narrower conclusion—AI tooling is appearing in real campaigns—not a claim that every recent breach was autonomous or AI-caused. [6]
A defensive counterweight: proofs with boundaries
Anthropic and Theorem describe a different use of AI: proving specified security properties of compiled software. Anthropic reports proofs covering 239 entry points across 123 open-source libraries, with Claude also finding bugs during the process. The work uses RISC-V binaries and a proof checker rather than simply accepting a model’s assertion that code is safe. [7]
The limits are important. The published guarantees apply under stated assumptions, including single-threaded static binaries, modeled Linux behavior, a fixed memory budget and inputs below 64 MB. They are not blanket certificates that whole libraries, applications or operating systems contain no bugs. The practical promise is to make certain rigorous checks more affordable and repeatable, alongside testing and human review. [7]
What organizations should take from this
The immediate priorities are operational: identify affected PHP runtimes, apply the appropriate vendor fixes, verify that updated runtimes are actually serving traffic, and follow incident-specific credential guidance where relevant. Browser and certificate-trust updates are separate maintenance responsibilities; they should not be conflated with patching PHP.
The longer-term implication is a capacity problem. Faster discovery can help defenders, but it also creates more reports to triage and more patches to validate. Maintainer funding, software inventories, coordinated response and deployment discipline become more—not less—important as research accelerates. These disclosures establish a serious change in the pace of security work. They do not establish that a single AI-driven event has broken the entire internet.
Sources
- PHP Foundation: Today’s PHP security release
- Wiz: PHP2Shell research
- OpenAI: Coordinated disclosure of critical vulnerabilities
- PHP official release archive
- Railway: Preliminary October security incident report
- CrowdStrike: ARTEX targeting South Korean finance
- Anthropic: Formal software verification
- Selected YouTube video
Comments (0)